WAFs

Web application firewalls (WAFs) are security solutions designed to filter, monitor, and block HTTP and HTTPS traffic to web applications in order to prevent attacks that target application layer vulnerabilities or sensitive data. They are typically deployed in front of a web server and enforce a policy that decides whether each request is allowed, blocked, or challenged.

WAFs can be deployed as on-premises appliances, cloud-based services, or hybrid solutions and may operate inline (reverse proxy) or out-of-band. They inspect traffic at the application layer (layer 7), use a combination of signature-based rules, behavioral analytics, and anomaly detection to identify malicious requests, and may perform TLS termination and re-encryption as part of inspection.

Common features include protection aligned with OWASP Top 10, input validation, and rules to block SQL injection, cross-site scripting, local/remote file inclusion, and command execution. Additional capabilities often include bot management, rate limiting, DDoS protection, virtual patching, API protection, logging, and integration with security information and event management (SIEM) systems.

WAFs are most effective when used to complement secure development practices and other controls. They can reduce risk for online storefronts, SaaS portals, and public APIs, and help with compliance in some industries. However, they require ongoing rule maintenance to minimize false positives and negatives, may be evaded by sophisticated attackers, and cannot compensate for insecure applications or misconfigurations. They may introduce latency and require tuning for legitimate traffic.

In practice, WAFs are part of a defense-in-depth strategy alongside network firewalls, API gateways, identity and access management, and secure coding practices.